ckksctl

JSON
executablemacOS200.0 KBx86_64, arm64

Code signing verification tool — validates and verifies macOS application signatures

Validates code signatures on macOS binaries and bundles using the Security framework and Keychain to access certificates. Verifies cryptographic signatures against trusted roots, checks for code signing entitlements, and confirms bundle integrity. Makes network connections to reach certificate authorities and revocation endpoints for signature validation. Collects telemetry during verification operations and references multiple bundle identifiers and file paths during analysis.AI

Fingerprint

Platform
macOS
Type
executable
Arch
x86_64, arm64
Min OS
26.1.0
SDK
26.1.0
File Size
200.0 KB
UUID
5CA680BA-E608-340D-91D2-689C9E4241CB
Analyzed
2026-04-07T05:21:13Z
CDHash
5e453b76df52260470cc9c41b2e54aee30184d3549849e64157995a4eb50f123

Entitlements1

Interesting Strings

Network Surface

Networking Frameworks

DNA Capability Vector

Location
0
Keychain
0
Network
0
Storage
0
Hardware
0
IPC
0
Analytics
0
Security
1
System
0

Behavioral Profile

URL Endpoints
4
Telemetry Strings
6
File Paths
3
Bundle IDs
3
IOKit Constants
0
Library Functions
0

Structural HashesSHA-256

Static Libraries0 / 52 functions identified

Functions(52)

0x100000ce8sub_100000ce8
0x100000e18sub_100000e18
0x100000e90sub_100000e90
0x100001460sub_100001460
0x100001518-[CKKSControlCLI .cxx_destruct]
0x100001524-[CKKSControlCLI setControl:]
0x10000152c-[CKKSControlCLI control]
0x100001538-[CKKSControlCLI toggleHavoc]
0x100001688sub_100001688
0x10000173csub_10000173c
0x10000177csub_10000177c
0x1000017c4-[CKKSControlCLI deleteSEZone:]
0x100001984sub_100001984
0x100001a14-[CKKSControlCLI modifySEZone:tlkShareJsonStrings:deletetlkShareJsonStrings:]
0x100001e84sub_100001e84
0x100001f14-[CKKSControlCLI fetchSEView:json:]
0x1000020e4sub_1000020e4
0x1000022e0sub_1000022e0
0x1000023d4sub_1000023d4
0x10000255csub_10000255c

Imports72 symbols from 5 dylibs

Exports1

_mh_execute_header0x0